Eco-Print & Cash, publisher of CodexBox — contact@codex-box.org. Full details are in the legal notice.
| Category | Data | Why | Legal basis | Where |
|---|---|---|---|---|
| Account | Phone number, password (hashed, never in clear), public wallet address; e-mail, first and last name if you provide them; identity-verification status returned by a partner; push notification token. | Create and secure your account, send you notifications, identify you to partners. | Performance of the contract. | Our servers (Google Cloud, Belgium) and Firebase Authentication. |
| Operations | Addresses, amounts, tokens, transaction hashes, order states; for a bank withdrawal: IBAN and beneficiary name; for the P2P market: the payment details you choose to share (Mobile Money number, payment handle), amounts, deadlines, reviews given and received. | Execute, track and secure your operations; coordinate the escrow; prevent fraud. | Performance of the contract; legitimate interest (security, anti-fraud); partners' legal obligations. | Our servers; the relevant partner; public networks (see §6). |
| P2P disputes | Messages exchanged with the other party and the arbitrator, images you upload as evidence (screenshots, receipts). | Investigate and settle the dispute. | Performance of the contract; legitimate interest. | Our servers. Images are served through signed links valid for one hour, visible only to the parties and the arbitrator. |
| Identity verification (partners) | First name, last name, date of birth, document number where required, front/back photos and selfie. | Meet the partner's verification obligation (Fonbnk and its verifier Smile Identity; Monerium through its own flow). | Partner's legal obligation; performance of the contract. | Forwarded to the partner. Not stored by us; only the status (pending / verified / rejected) is recorded. |
| Contact discovery | Keyed cryptographic fingerprints (HMAC-SHA256) of the numbers in your address book — never the numbers themselves. | Find friends who already use CodexBox, at your request. | Consent (system permission and explicit action). | Processed for the duration of the request, not stored. |
| Technical data | IP address, timestamp and request path in server logs; app version. | Run and secure the service, diagnose incidents. | Legitimate interest. | Our hosting provider's logs, kept for 30 days. |
| On-device data only | Analysed SMS and the resulting budget, stock and business tools, local history, offline queue, PIN, preferences. | Personal and business management features. | Consent (SMS); performance of the contract. | Your device, in an encrypted database. Never transmitted. |
| Permission | Use | Required? |
|---|---|---|
| SMS (receive, read) | Read, on the device, Orange Money and MTN MoMo transaction SMS to keep your budget and to tell you that a payment matching a P2P trade has arrived. Other SMS are ignored without reading their content. A consent screen precedes the permission request. No SMS ever triggers an operation: you always confirm yourself. | No — optional, revocable in Android settings or in the app. |
| Contacts | Two purposes described in §5. | No. |
| Camera | Scan a QR code; photograph an identity document for a partner; attach evidence to a dispute. Identity photos are recompressed on the device (without the original's metadata, such as location) and then forwarded to the partner; the working copy is deleted after sending. | No — only for these features. |
| Phone (calls, phone state) | Dial, at your request, a Mobile Money operator USSD code; detect the country and operator of your SIM to offer the right service. No call is placed without your action; no number is transmitted. | No. |
| Notifications | Inform you of an operation (transaction confirmed, P2P payment to declare or received, withdrawal executed). Remote notifications go through Firebase Cloud Messaging. | No, but recommended for the P2P market. |
| Biometrics | Confirm a sensitive operation by fingerprint. Handled by Android; the app reads no biometric data. | No — falls back to PIN or password. |
| Internet, network state, boot, wake lock | Communicate with our servers and public networks; resume the offline queue when connectivity returns or after a reboot. | Yes. |
Access to your address book serves two distinct purposes, which we describe separately because they do not treat your contacts the same way.
Finding friends who already use CodexBox (optional feature). When you explicitly start a contact search, the app turns each number in your address book into a keyed cryptographic fingerprint (HMAC-SHA256) on your device, then sends only those fingerprints to our servers to match them against registered users. The numbers themselves are not sent. Our servers use the fingerprints for the duration of the request and do not keep them.
Warning you before sending to an unknown recipient. Before a transfer to a recipient you have never sent money to, the app checks whether the number is in your address book, in order to decide whether to warn you that the operation is irreversible. This check runs entirely on your device: neither your address book, nor its fingerprints, nor the result of the check are sent to our servers for this purpose. The processing rests on our legitimate interest in preventing fraud (GDPR article 6.1.f). You may refuse address-book access: the warning will still be shown, based on the other signals available.
Your transactions are recorded on public networks (Celo, Gnosis). Your wallet address, the amounts and the counterparties of each transaction are visible to everyone and permanent; neither you nor we can erase them. These networks do not contain your name or phone number; the link between your identity and your address exists only in our systems and with the partners you identified yourself to.
We do not sell your data and share it with no one else.
On the device: keys encrypted by the Android Keystore (AES-256-GCM), encrypted local database (SQLCipher), PIN verified locally with lockout after several failures, confirmation by fingerprint, PIN or password before any operation that moves funds, sign-in screen protected against screenshots. In transit: HTTPS required, no cleartext traffic. On our servers: secrets in a managed vault (Google Secret Manager), restricted access, signature checks on partner notifications. No measure is perfect: in the event of a data breach that puts you at risk, we will inform you and notify the competent authority within the legal deadlines.
You may request access to your data, its rectification or erasure, restriction of processing, object to processing based on our legitimate interest, withdraw a consent (SMS, contacts) and obtain your data in a readable format. Write to contact@codex-box.org from the e-mail or number linked to your account; we reply within 30 days. You may also lodge a complaint with your country's data-protection authority.
Our servers are hosted in the European Union (Belgium). Some partners operate outside the European Union or outside your country; they access only the data needed for their service, under their own contractual safeguards.
CodexBox is for adults only. We do not knowingly collect data from minors; if you believe a minor has created an account, write to us and we will delete it.
This policy may change. The version in force and its date appear at the top of the page. Material changes are announced in the app.